AIAA-2002-1267 


An Approach to Risk-Based Design Incorporating 
Damage Tolerance Analyses 

Norman F. Knight, Jr. 

Veridian Systems Division, Chantilly, VA 

Edward H Glaessgen and David W. Sleight 
NASA Langley Research Center, Hampton, VA 


43 rd AIAA/ASME/ASCE/AHS/ASC 
Structures, Structural Dynamics, 
and Materials Conference 
and Exhibit 

22-25 April 2002 
Denver, Colorado 


For permission to copy or to republish, contact the copyright owner named on the first page. 
For AIAA-held copyright, write to AIAA Permissions Department, 

1801 Alexander Bell Drive, Suite 500, Reston, VA, 20191-4344. 



An Approach to Risk-Based Design 
Incorporating Damage-Tolerance Analysis 


AIAA-2002-1267 


N.F. Knight, Jr.' 

Veridian Systems Division 
York town, VA 23693-2619, U.S.A. 

E. H. Glaessgeir and D. W. Sleight 1 2 
NASA Langley Research Center 
Hampton, VA 23681-0001, U.S.A 


Abstract 

Incorporating risk-based design as an integral part 
of spacecraft development is becoming more and 
more common. Assessment of uncertainties 
associated with design parameters and 
environmental aspects such as loading provides 
increased knowledge of the design and its 
performance. Results of such studies can 
contribute to mitigating risk through a system- 
level assessment. Understanding the risk of an 
event occurring, the probability of its occurrence, 
and the consequence(s) of its occurrence can lead 
to robust, reliable designs. This paper describes 
an approach to risk-based structural design 
incorporating damage-tolerance analysis. The 
application of this approach to a candidate Earth- 
entry vehicle is described. The emphasis of the 
paper is on describing an approach for 
establishing damage-tolerant structural response 
inputs to a system-level probabilistic risk 
assessment. 

Introduction 

Advanced aerospace systems are becoming 
increasingly more complex, and customers are 
demanding lower cost, high performance, and 
high reliability. Increased demands are placed on 
the design engineers to collaborate and integrate 
design needs and objectives early in the design 
process to minimize risks that may occur later in 
the design development stage. The design 
process itself becomes a balancing process 
between risk and consequences. High- 
performance systems require better understanding 
of system sensitivities much earlier in the design 


process to meet mission goals. This 
understanding is developed through enhanced 
concept selections, heritage data, and enhanced 
analytical tools. As such, the design of advanced 
aerospace systems demands a full understanding 
of system functionality, system 
interdependencies, system risks, and possible 
failure scenario [1], This understanding of the 
system cannot be attained from a single discipline 
view, irrespective of the depth of understanding in 
that discipline. A systems-engineering 
perspective with in-depth understanding in at least 
one discipline critical to the design contributes 
significantly to understanding and mitigating risk 

m. 

Probabilistic risk assessment (PRA) involves the 
combination and integration of systems 
engineering, discipline specific analyses, 
statistics, decision theory, and heritage data 
(experience). PRA represents a systematic 
approach for identify ing factors and events that 
have potential to affect mission success and 
system performance [2, 3], System-level 

information and integration are needed for a 
complete vehicle PRA that identifies and 
prioritizes risk associated with some event. The 
occurrence of an event (eg, off-nominal 
condition, subcomponent failure, or accumulation 
of tolerances) and the severity of the 
consequences associated with this event can be 
quantified. Guidance is thereby provided for 
modifying the design to mitigate known risk in 
order to meet specified system requirements for 
reliability and robustness. 
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The objective of this paper is to describe an 
approach to risk-based structural design that 
incorporates damage tolerance. Emphasis of this 
paper is on the quasi-static response of the 
spacecraft to launch and entry load cases. Other 
conditions associated with spectral loading, shock 
loading, and impact, while readily accommodated 
by the proposed approach, are not included in the 
present discussion. The proposed approach 
incorporates progressive ‘failure analyses and 
fracture mechanics methods to assess damage 
tolerance for composite spacecraft systems. 
Complex, detailed nonlinear finite element 
simulations are used to evaluate structural 
integrity for various loading conditions. Selected 
design parameters are identified as key 
parameters with some known statistical 
distribution along with response metrics for the 
spacecraft mission associated with structural 
performance. The computational cost of 
deterministic nonlinear finite element simulations 
is significant and necessitates an alternate 
approach for the probabilistic calculations such as 
response surface methodologies. Multiple 
response surfaces are proposed for the spacecraft 
system and its mission. These response surfaces 
are defined based on the results of deterministic 
analyses. Each of these steps is described and 
discussed in detail in the following sections. 

Proposed Approach 

Mission goals define system requirements, many 
of which may have direct bearing on the structure, 
while many others may not. Those that do have a 
direct bearing on the structure need to be cast into 
quantifiable design performance or response 
metrics. In addition, selected design parameters 
or groupings of design parameters and their 
statistical variations need to be defined. 
Probabilistic assessment of the design can then be 
made using deterministic analysis tools to 
evaluate the effects of combinations of the 
random input variables on the response. Through 
detailed study, the overall design space may then 
be approximated using response surfaces defining 
system response metrics developed using large- 
scale finite element structural analysis 
simulations. Hence, the approach to risk-based 
design incorporating damage-tolerance analyses 
involves four basic steps. First, response metrics 
on the structural design performance are 
developed based on system-level requirements for 


the vehicle in general and those related to specific 
disciplines in detail. This results in formulating 
master logic diagrams and functional event 
sequence diagrams that identify failure scenarios 
and their consequences due to system 
uncertainties, limited knowledge or heritage data, 
or other subsystem failure. Metrics may be 
explicitly defined within the design documents or 
may need to be implicitly imposed. After metrics 
are defined, the designer has measures of success 
to assess the impact of uncertainties on 
performance. Second, design parameters that 
strongly influence the structural performance are 
defined along with their statistical variation. 
These statistical variations may be obtained from 
testing or other sources. These two steps are 
crystallized by developing event sequence 
diagrams for structural performance and thereby 
establish an understanding of the interplay 
between subsystems and the structure. Third, 
response surfaces approximations are developed 
based on detailed finite element analysis results 
for use in probabilistic analysis as a fast 
computational substitute for large-scale finite 
element simulations. These finite element 
simulations for specified combinations of the 
design variables include a damage tolerance 
assessment and account for material damage, 
delamination growth, and local stiffness 
discontinuities. Finally, probabilistic analyses are 
performed and quantifiable risk measures for 
mission success generated. 

Risk-Based Design 

Risk-based design means that known uncertainties 
associated with the design are assessed and their 
impact determined. Uncertainties may be related 
to material mechanical properties, geometric 
shape, loads, or even outside influences that are 
consequences of other, seemingly unrelated, 
system response to ofT-nominal conditions. 
Robustness implies that the system design is 
nearly insensitive to these uncertainties; that is, 
the vehicle design mitigates their influences. 
Probabilistic methods are used to quantify the 
occurrence of such events given certain statistical 
distributions of design parameters and their mean 
values. In addition event sequence diagrams are 
needed to identify potential critical conditions and 
serve as guides to mitigate risk and increase 
system reliability. 
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Deterministic analysis tools are commonly used 
in these assessments to evaluate the structural 
performance for a given set of design variables 
and response metrics used to characterize mission 
success. Deterministic analyses can be simple 
analytical models or large-scale finite element 
models. In the latter case, these analyses can 
overwhelm typical computational infrastructures 
unless high-throughput computing models (e.g., 
[4-7]) are utilized. An alternative approach is to 
employ response surface approximations (e.g., [8- 
10]) that are defined using a selected subset of the 
design variables and deterministic nonlinear 
structural analyses. The response surface 
approximations are then used in the probabilistic 
risk assessment. To this end, the risk-based 
design approach studied here utilizes response 
surfaces defined using a two-level full factorial 
model. A two-level factorial design approach 
defines a first-order response surface with 
interaction terms. The two-level factorial design 
approach uses low and high values of selected 
design variables to define a response surface. For 
a two-level full factorial design, the number of 
deterministic analyses is related to the number of 
design variables that w ill be considered as random 
variables in the probabilistic analyses. That is, for 
NRV random variables, 2 NRV deterministic 
analyses are required. 

Damage-Tolerance Analyses 

Damage tolerance may be defined as the 
structure's ability to contain weakening defects 
under representative loading and retain adequate 
residual strength to meet mission requirements 
[11]. Damage-tolerance analyses are performed 
to determine the structure's ability to continue to 
function, in a structural sense, after damage 
initiation and possible propagation while in 
service. Damage-tolerance issues for spacecraft 
systems are critical due to the spacecraft cost and 
overall program visibility. 

Nonlinear finite element simulations of the launch 
and re-entry loading cases provide critical 
information about the structural design in 
establishing the reliability of the spacecraft 
system to achieve its mission. Nonlinear finite 
element simulations are used to evaluate at least 
four issues. First, the nonlinear structural analysis 
simulations are used to determine the extent of the 
deformations and their gradients. These 


deformation patterns can be used to validate the 
assumptions used in the aerodynamic simulations 
U\g., maintain aerodynamic shape). Second, the 
nonlinear simulations are used to determine any 
occurrence of strength-related material failures 
(/.<?., yielding of metal structures or brittle failures 
for composite materials) and any propagation of 
damage is related to these strength-related 
failures. Such a simulation is referred to as a 
progressive failure analysis or PFA. However, 
initiation of local material failures, while 
requiring careful study and understanding of their 
cause, may not prevent the spacecraft from 
fulfilling its mission. Third, the nonlinear 
simulations are used to determine whether initial 
defects (initial delaminations or disbonds) in a 
spacecraft structure when subjected to launch 
loading will propagate. These defects or initial 
damage could be initial delaminations or initial 
disbonds not detected by NDE techniques 
employed during inspection. This initial damage 
could also be damage that develops as a result of 
the launch loads. Fourth, the nonlinear 
simulations are used to determine whether 
delaminations or disbonds present at re-entry will 
develop and propagate. The delaminations 
considered at this step are an accumulation of 
those associated perhaps with manufacturing oi 
fabrication delaminations that are smaller than 
NDE inspection limits and those are predicted to 
occur as a result of the launch loads. Similarly 
disbonds are associated with a local bond line 
failure (e.g., bonded joints or bonded flanges). 
While these two failure modes are different, 
analysis models often treat them in the same 
manner. 

Hence the damage-tolerance methodology to be 
employed for a damage-tolerant spacecraft 
structural analysis involves two distinct phases. 
One phase predicts strength-related failure 
initiation and growth that occur during loading. 
This phase, progressive failure analysis (PFA), is 
predicted using a two-dimensional classical 
lamination theory approach with failure initiation 
criteria and ply discounting (or similar scheme) as 
the material degradation model. The other phase 
predicts damage growth from an assumed 
disbond, delamination, or combination of both 
that are embedded in the laminate. In addition, 
strength-related failures may also occur as a result 
of these embedded flaws. This phase requires 
using locally refined regions in the finite element 
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model and a strain-energy-release-rate 
calculation. Each phase typically employs 
separate structural analysis models with the latter 
requiring locally refined models to embed the 
initial damage and monitor its propagation. 
However, a single finite element model with all 
structural details (bolt holes, penetrations, flanges, 
and joints) included could be used in all phases 
provided the computational infrastructure can 
deliver the computing resources for the 
simulations. 

Treatment of Material Damage 

Nonlinear finite element simulations including 
progressive failure can be performed using a 
variety of structural analysis tools as illustrated, 
for example, by Sleight [12] and Knight et al. 
[13]. Typically nonlinear finite element analysis 
tools are used because geometric nonlmearities 
(large-deflection, large-rotations) are coupled 
with material nonlinearities (nonlinear elastic, 
inelastic, brittle damage) in determining the 
structural response. PFA involves the detection 
of local material failure initiation, material 
degradation, and damage propagation. Failure 
initiation criteria such as the maximum strain 
criteria, the Tsai-Wu failure polynomial [14] or 
the Hashin criteria [15] are commonly used for 
laminated composite structures. Many researchers 
including Singh et al. [16], Soden et al. [17], 
Sleight [12], and Knight et al. [13] discuss the use 
and assessment of these failure criteria for 
laminated composite structures. Continuum 
damage models based on internal state variables 
( e.g Talreja [18]) may also be used but typically 
require additional material data for them to be 
used. If the spacecraft is fabricated using a 
process different from lamination of 
unidirectional plies with various orientations (e.g., 
textile composites or non-polymeric composites), 
then other failure models and material 
degradation models would be employed. 
Material degradation models also vary depending 
on the failure criteria, but generally they are based 
on ply discounting where lamina material 
stiffness coefficients are reduced in value from 
their elastic value. Damage propagation requires 
following the material failure pattern and re- 
establishing equilibrium as new' failures are 
detected, local material degradation occurs, and 
stress redistribution develops. 


Failure criteria are evaluated at each material 
point in the composite structure. A material point 
is defined as a location within the laminate 
thickness (possibly several points in each ply) and 
at a given surface location that is defined by a 
surface integration point or Gauss point for a 
specific shell element. For example, a single 4- 
node shell element with four surface-integration 
Gauss points and a 16-ply laminate w ith one point 
through each layer would have a total of 
4x16x1=64 material points per element. Once 
failure has been detected, the elastic mechanical 
properties are degraded to zero (or nearly zero) 
and archived for use in subsequent calculations. 
Each material point has a set of state variables 
that include the failure mode flags (fiber and 
matrix), the failure index for each mode, an 
overall failure flag, and the material degradation 
factor - nine state variables per material point. A 
holistic PFA methodology [12] shown in Figure 1 
includes material coupon testing to determine 
material properties, progressive failure analysis 
incorporating phenomenological models to 
predict failure and material degradation w ithin the 
finite element analysis, and testing of 
representative structural configurations to validate 
the analysis. 

Treatment of Delaminations and Disbonds 

Fracture mechanics methods (e.g., Broek [I9J. 
Aliabadi and Rooke [20], and Anderson [21]) are 
used to evaluate whether initial cracks, 
delaminations, or disbonds will grow and whether 
that growth is stable or unstable. Assessment of 
disbond or delamination growth is obtained using 
several computational approaches such as the 
force method [22], equivalent domain integral 
method [23], virtual crack closure technique or 
VCCT [24, 25], and the crack tip opening 
displacement (or CTOD) method [26]. The 
computed strain energy release rates can then be 
compared to the interlaminar fracture toughness 
values of the material. The interlaminar fracture 
toughness is determined for Mode I, Mode II, and 
mixed mode loadings using double cantilever 
beam (DCB), end notch flexure (ENF), and mixed 
mode bending configurations, respectively, as 
indicated in Figure 2. 

References [27-35] provide benchmark 
computational results for two- and three- 
dimensional analyses, applications to disbond 
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simulations using shear-flexible shell elements, 
and computational aspects of the method. Once a 
deterministic finite element analysis has been 
performed, the fracture mechanics parameters are 
evaluated. These post-processing computations of 
the finite element results are required to calculate 
the strain energy release rates. As such, an a 
priori determination of the way the damage will 
grow is needed and special attention to local mesh 
refinement is required. This approach can be 
coupled with PFA. 

Three hypothetical curves of strain energy release 
rate vs. delamination or disbond length (G vs. a) 
are shown in Figure 3. Hypothetical initial and 
final delami nation or disbond lengths, a 0 and a,. 
respectively, are shown by the vertical lines. The 
initial value, a<> , is typically assumed to 
correspond to the smallest detectable flaw size, 
while the final value, a /; corresponds to a 
completely delaminated member. Curve A 
represents a condition where unstable growth may 
occur because the value of G is larger than the 
critical strain energy release rate G c once the 

delamination reaches a length corresponding to a 
(Point a, in Figure 3). In contrast, curve B 
represents a condition where growth will not 
occur for any crack length n () <a<a f as G<G t for 
all delamination lengths considered. Finally, 
curve C represents a condition where unstable 
growth occurs between points c } and c 2 

(< cj<a<c 2 ) and is arrested once the delamination 

reaches a length c : \ Arrest in curve C neglects 
inertia (inertia effects are discussed by Broek 
[19]). 

Another approach for treating delaminations and 
disbonds involves the use of recent developments 
related to decohesion or interface element 
formulations for strain-softening materials [36- 
40], These models require overlaid shell elements 
in the regions where delaminations and/or 
disbonds are expected to occur. The decohesion 
formulation also requires a priori determ i nation 
of the w r ay the delamination will grow although 
not as restrictive as some methodologies. The 
simulation begins without any delaminations or 
disbonds. During the simulation, local response 
may be such that a delamination or disbond 
initiates and grows. The decohesion element 
modeling approach provides a computational tool 


for damage tolerance. This approach can also be 
coupled with PFA. 

Response Surface Approximations 

Each response or performance metric is evaluated 
for each combination of selected design variables. 
These results are then used to define a response 
surface of a given shape [8-10, 41]. While 
multiple response functions may be included 
easily through additional post-processing of the 
deterministic analyses, increasing the number of 
selected design variables has a significant impact 
on the computational effort. A fundamental 
assumption in the use of this approach for 
preliminary design assessment is the functional 
form of the response surface approximation (/.<?., 
first-order, second-order, or higher-order). 
Implicit assumptions are made regarding the 
accuracy of the response surface approximation 
relative to the actual response. The following 
sections describe a proposed approach to 
incorporate damage tolerance analysis into the 
risk assessment by defining appropriate sets of 
selected design variables and structural 
performance metrics. 

Design Variable Selection 

The selection of design variables to be included in 
the damage-tolerant risk assessment is a key step 
in the process. The number and definition of 
these design variables has two effects. First, 
selection of variables that influence the structural 
behavior as reflected in the performance metrics 
is critical. Second, the number of variables 
defined relates directly to the magnitude of the 
computational task (e.g., on the order of 2 NRV 
deterministic calculations). For example, the 
elastic mechanical properties of the composite 
material (E n , E 22 , E 33 , G l2 , G 23 , G l3 , v !2 , v 23 , v L3 ) 
and the strength allowable values (X T , X c , Y T , 
Yc Zc, S X y, S yz , S xz ) define eighteen 
independent variables that affect structural 
performance. In this case each composite 
material type used in the design would require 2 18 
(or 262,144) deterministic analyses in order to 
form a response surface based on a two-level full 
factorial approach. For example, if each analysis 
required one-minute of CPU time then 
approximately 182 CPU days would be required. 
Such an approach does not appear to be tractable 
at the present time. Therefore, design variables 
are grouped together f /. c. , moduli group and 
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strength group), having their own mean values 
and standard deviations, but sharing a common 
probability density function. The approach used 
to incorporate damage tolerance analysis into the 
risk assessment is to group related design 
variables together and assume that all terms in a 
group share the same statistical distribution (/.<?., 
normal distribution or Weibull distribution). 
Again if sufficient computing resources are 
available, each design variable could be treated 
individually. 

Response Surface Definition 

A response surface is a mathematical 
approximation of a specific system response as a 
function of a set of design variables [8-10, 41 J. A 
fundamental assumption is required pertaining to 
the functional form of that surface (i.e., first- 
order, second-order, or higher-order). Multiple 
response metrics can be involved to assess the 
robustness and reliability of the system. 
Development of multiple response surfaces (/.e., 
NRS is the number of response surfaces to be 
generated) should require only data extraction or 
post-processing of the deterministic analyses 
rather than additional simulations. Representation 
of the I-th response surface (from a total number 
of NRS response surfaces) can be expressed as 

nr i 

R ,(*i) = "o + Z a t x t 

k = ! 

NRC NR V 

+ Z Z a u x k x, 

k = I i= k + \ 

NR V NRV NR V 

+ Z Z H a klmX k X,X m 

k — 1 /— k + 1 m = / + | 


where x ) represents the coded variable set, Ri 
represents the 1-th response metric to be “fitted 1 ' 
to a surface (could be up to NRS response surface 
definitions needed), and a ky a kh and a kfm are the 
unknown coefficients to be determined. The 
coded variables (normalized physical variables) 
range in value between ±1 and relate to the low 
and high values of the natural variables 
(unnormalized physical variables). Response 
surface approximations of this type involve 
products of variables but no variable is raised 
above the first power (i.e., no squared terms). 


This type of response surface is classified as a 
first-order model with interaction terms. 

To determine these coefficients a k/ , and a kfm ), 
specific unique combinations of the design 
variables are defined, and for each combination, 
the system response is determined - a 
deterministic analysis typically from which the 
response metric is extracted maximum 

principal strain). The coefficients are then 
determined by solving a set of linear algebraic 
equations that is 2 NRV x 2 NRV in size and lully 
populated. Using the coded variables, this system 
is expressed in matrix form as: 

{R} = [A]{a} 

where { R } is a vector containing the value of the 
response metric for each combination of the 
coded variables, {a} is a vector of undetermined 
coefficients for the response surface, and [A] is a 
matrix of constants (±l's associated with the 
coded variable values for each combination). 
This system can be readily solved using 
traditional linear equation solvers. 

Application to Earth-Entry Vehicles 

To illustrate the outlined approach, application to 
a candidate Earth-entry vehicle (EEV) [42-44] 
shown in Figure 4 is considered. Vehicles of this 
type are part of the payload for some launch 
vehicle. Once in orbit, mission objectives are 
addressed and the vehicle returns to Earth 
experiencing loading conditions associated with 
re-entry through the Earth's atmosphere. Mission 
success has two aspects. One aspect is the return 
of science data, and the other aspect is the 
protection of the biosphere. As a result, reliability 
and robustness design requirements are extremely 
high. To mitigate risk and address the impact of 
possible off-nominal conditions, a scoping 
probabilistic risk assessment (PRA) was 
conducted on EEV systems to quantify the 
probability of mission success [45]. This paper 
addresses one aspect of the design process that 
contributes to the mission success requirements; 
namely, structural performance of the EEV 
aeroshell - a critical driver for EEV structural 
design. 
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Candidate EEV Mission Scenario 

Candidate EEV mission scenarios are similar (see 
[42-44]). An EEV is launched as payload on some 
launch vehicle. It performs its science mission 
and then returns to Earth. From a structures 
perspective, the EEV structure has three 
functions. First during launch, the EEV structure 
will react body forces associated with launch 
accelerations. The EEV will be mounted to the 
launch vehicle using several hold-down 
mechanisms (typically bolts) that have the 
potential to generate severe local stress gradients. 
Second during re-entry, the EEV structure needs 
to provide support for the external thermal 
protection system or may need to serve a 
multifunctional role for carrying both structural 
and thermal loads. Third during re-entry, the 
EEV staicture needs to retain its shape for 
aerodynamic performance and other mission 
related aspects. To this end, the approach to risk- 
based design incorporating damage tolerance 
analyses described in the previous sections is 
applied to a candidate EEV aeroshell structure. A 
representative event sequence diagram for this 
aspect of the design (structural integrity during re- 
entry) is presented in Figure 5. The analyses 
described provide the necessary' input for 
generating response surfaces that are then used in 
the probabilistic analyses as indicated on Figure 
5. Impact protection is provided by the impact 
sphere (e.g., see Kellas [46] for design, 
fabrication and testing results and Billings et ai 
[47] for nonlinear transient dynamic simulations) 
rather than the aeroshell and is not part of the 
EEV aeroshell structural design problem. 

Candidate EEV Configuration and Finite 
Element Modeling 

A candidate configuration of an EEV system [44] 
is a 0.9-m-diameter, spherically blunted, 60- 
degree half-angle cone forebody (see Figure 4). 
The forebody heat shield is 12-mm thick. The 
EEV primary- structures include a forward 
structure, an aft structure, a cylindrical support 
skirt, a 0.3-m-diameter impact shell, and a lid 
structure (covers the aft side of the impact 
sphere). These structures are generally thin 
except near intersections between the internal 
skirt (support cylinder) and the forward and aft 
structures, between the forward-aft structures 
interlace (EEV outer tip), and near the three 
mounting bolts on the aft staicture which have 


metal reinforcement. Dimensions quoted here are 
representative for the structures at a conceptual 
design level. Each component has a near uniform 
thickness: forward staicture is 2.5-mm thick, the 
aft structure is 2-mm thick on the sloping section 
and 4-mm thick in the Hat region with the 
mounting bolt holes; and the skirt is 2-mm thick. 
Analyses have indicated that for the launch and 
re-entry load cases considered the lid staicture 
and the impact sphere are only lightly loaded and 
thus are considered as linear elastic with no 
damage in subsequent simulations. 

A series of finite element models of a candidate 
EEV are developed using the geometry definition 
and assessed in order to verify modeling 
assumptions and discretization effects. In this 
study, the composite structures are modeled using 
two-dimensional shell elements except near the 
outer connection between the forward and aft 
structures (near the EEV outer tip). The foam 
between the skirt and the impact sphere and the 
thermal protection system are assumed to have 
linear elastic behavior and modeled using three- 
dimensional solid elements. The cylindrical skirt, 
which bounds the foam and connects the forward 
and aft aeroshell structures, is modeled using shell 
elements. Composite structure components are 
modeled using classical lamination theory- - 
implicit assumption on composite fabrication 
approach and material constituents; that is, layers 
of unidirectional polymer-based lamina. 

A certain degree of symmetry does exist in the 
configuration of the structure and the re-entry 
loading case. However, the launch load cases 
may cause damage initiation and propagation that 
are not symmetric. As a result, only full-vehicle 
finite element models are considered. The finite 
element model, Model 1, is defined as a detailed 
360-degree model of the EEV having 
approximately 100,000 elements and 100,000 
nodes - over six million material points to 
examine for material damage. In this model, the 
two vent holes and the three mounting bolt holes 
on the aft structure are explicitly modeled and 
include a local flange for the mounting bolts on 
the aft structure. Regions of the model for which 
damage is anticipated (/>., modeled for PEA) 
have one through-lhe-thickness integration point 
per layer. Increasing this to three points per layer 
would significantly increase the analysis 
computing time. Regions of the model for which 
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damage is not anticipated (lid structure and 
impact sphere) are modeled as elastic only. 
Various Unite element models and their basic use 
are summarized in the Computational Approach 
Section. 

Before proceeding further, a few comments are in 
order. First, the commercial structural analysis 
tools themselves are generally accurate and 
reliable in terms of correctly performing the 
calculations. However, few commercial structural 
analysis tools provide automated adaptive 
modeling features to ensure accuracy during a 
nonlinear response simulation - with the possible 
exception of sheet-metal forming. Second, the 
material constitutive models including elastic 
response, failure behavior, and material 
degradation are limited to common material 
systems and fabrication types. However, 
advanced vehicle designs typically use advanced 
materials technology ( e.g three-dimensional 
woven composites, ceramics, and foams) and 
direct representation of new materials fabricated 
using new methods is often only approximate. 
Finally, prediction of damage-tolerant structural 
behavior is very complex and problem dependent. 
Local stress and strain re-distributions due to 
damage initiation and growth will occur and 
requires automated remeshing techniques or 
manual remeshing and re-solution 
Generalizations regarding these aspects of the 
analysis, especially with regard to correctness and 
appropriateness, cannot be made. 

Loading Cases 

There are two loading conditions to be considered 
in the EEV analysis: launch and re-entry. Since a 
specific launch vehicle is undecided, this 
uncertainty is addressed by considering eight 
different launch load cases to envelop the 
acceleration characteristics of several candidate 
launch vehicles. Hence, eight different launch 
load cases are defined and analyzed to account for 
the uncertainty associated with launch vehicle 
selection. The re-entry loads case is defined 
based on the likely deceleration of the vehicle 
upon re-entry. This load can vary depending on 
vehicle orientation and trajectory. Here the re- 
entry loading is considered to be known with 
certainty. 


Selected Design Variables 

Design variables having a significant influence on 
the structural design including damage tolerance 
are identified and grouped together, if needed. For 
this study, six groups are identified. The elastic 
mechanical properties are grouped together as one 
group. Another group represents the material 
strength parameters, while another group involves 
the fracture toughness parameters of the aeroshell 
material. These three groups are commonly 
defined as design variables significantly affecting 
structural performance; however, they do not 
represent the complete picture. Two additional 
design variable groups and one load variable 
group are identified. The first design variable 
group is related to the failure indices for failure 
initiation (failure index group) and the other is 
related to initial flaw size for de laminations and 
disbonds (flaw size group). 

The first three groups are defined based on 
material characterization testing and heritage data 
for the material system. The fourth group 
accounts for uncertainty in the failure model. The 
fifth group is defined accounts for uncertainty in 
the initial flaw size in fracture mechanics 
analyses. The sixth group is based on trajectory 
and orientation predictions from re-entry 
aerodynamic simulations. 

The failure index group involves the failure model 
and its associated failure modes. For the present 
approach, HKS/ABAQUS Standard [48] is 
employed as the nonlinear finite element analysis 
tool. This tool offers a robust nonlinear solution 
strategy, ability to incorporate user-defined 
material models and elements, and a multi- 
processor capability. Specific failure models and 
material degradation models are incorporated 
through a user-defined constitutive model using 
UMAT [48]. This material model consists of a 
two-dimensional classical lamination theory 
approach with the Hashin failure criteria [15] and 
ply discounting as the material degradation 
model. Failure indices for the Hashin criteria are 
related to fiber and matrix failures and involves 
four failure modes defined as: 
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In these failure criteria, lamina strength 
allowables for tension and compression in the 
lamina principle material directions (fiber or 1- 
direction and matrix or 2-direction) as well as in- 
plane shear strength allowable are denoted by X T , 
A'c, Yj\ Yc, and respectively. In-plane normal 
and shear stress components are denoted by 
(i.j= 1,2). Finally, fiber and matrix failure indices 
for tension and compression (e, h e fc , e mtt e mc ) are 
then compared with a specified limit p to indicate 
whether failure is predicted. Typically the value 
of P is unity; however, within the PRA approach 
described here, p will be allowed to take on 
values less than unity in an attempt to account for 
the uncertainty in the appropriateness of the 
failure model. One alternative approach to dealing 
with the uncertainty of the selected failure criteria 
would be to evaluate concurrently several failure 
criteria (i.e., maximum strain criteria, Hashin 
criteria, Tsai-Wu criteria) and then define failure 
when any criterion is exceeded. Hence this group 
varies the failure limit from a value of unity to a 


smaller value p (i.e.. 0<P<1 ). In effect, when p is 
less than unity, failures would be initiated earlier 
(i.e., at a lower load level) and thereby account, in 
some sense, for the uncertainty regarding the 
appropriateness of the selected failure model for 
the composite material architecture. The 
approach is to assign this failure limit to all failure 
modes considered; however, different values 
could be used for each failure mode or for 
individual components (fiber or matrix). 

The flaw size group involves any and all flaws 
embedded within the finite element model and 
associated finite element modeling changes to 
accommodate these new flaw sizes. Again the 
flaw size distribution is assumed to be the same 
for all flaws even though the initial flaw' size and 
its mean value may be different. Based on the 
virtual crack closure technique (VCCT). local 
computation of strain energy release rates uses 
nodal forces and nodal displacements in the 
vicinity of the delamination or disbond front. The 
strain energy release rates are computed using 
locally refined regions in the finite element model 
at a well-defined interface between layers of the 
composite material [27-35], 

One final variable is defined as the magnitude of 
the re-entry loading (load variable group). This 
variable is not directly related to the structure 
itself but has the potential to affect the results 
dramatically. The re-entry loading condition is a 
function of other vehicle characteristics on re- 
entry such as orientation and trajectory. 

The structures’ input to the PRA is based on a 
series of analyses for both the launch and re-entry' 
conditions as indicated by the event sequence 
diagrams shown in Figure 5. Using a two-level 
full factorial design model, design parameters are 
varied from their mean values to extreme values 
( i.e ., negative two sigma for the physical 
parameters or a value of -1 for the coded 
variables). The number of required deterministic 
analyses increases as 2 NRV where NRV is the 
number of design variables that will be considered 
as random during the probabilistic analyses. 
Results from these analyses are used to define a 
response surface for each response metric based 
on two-level full factorial design approach. The 
number of required simulations can rapidly 
become prohibitively high for large-scale finite 
element models such as the one developed for the 
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candidate EEV (approximately 100,000 nodes). 
Thus, measures must be taken to insure all 
required analyses are performed and to 
understand how they will be used. Reducing the 
number of variables will reduce the number of 
analyses needed - provided the sensitivity' of 
structured response to the design variables is 
known and understood. 

Response Metrics 

Several response or performance metrics on 
structural performance may be identified from the 
event sequence diagrams in Figure 5 and then 
analytically defined in relation to mission success. 
Note that failure initiation, initial flaws, and 
possible damage propagation do not necessarily 
result in mission failure. Response metrics are 
needed that define overall structural failure that 
would prevent an EEV from accomplishing its 
mission. The interface between the damage 
tolerance analyses and the probabilistic risk 
assessment is dependent on the variables 
extracted from the damage tolerance analyses. 
Because the number of nodal degrees of freedom 
and element quantities (/.<?., u„ c,j, a (J , G t , G u , etc.) 
is potentially enormous, response metrics for 
structural response within the PRA must be 
computed at the vehicle system level. That is, the 
damage tolerant analyses must determine whether 
or not the vehicle is capable of sustaining launch 
and re-entry loads. Three structural-performance 
response metrics are considered for an EEV with 
a composite aeroshell design: a strength-based 
factor; a toughness-based factor; and a shape- 
based factor. These factors or response surface 
parameters for re-entry determine whether or not 
the structural integrity of the EEV has been 
compromised. 

The strength-based factor is taken as the ratio of 
the largest sustained load at a converged 
increment in the nonlinear progressive failure 
analysis (PFA) to the re-entry design load. This 
strength-based factor is computed for each 
combination of variables and may take on a value 
equal to or less than unity. A value less than 
unity indicates convergence difficulties in the 
PFA numerical solution due to a discontinuous 
load path, loss of structural stiffness, and the 
structure is determined to have failed. Hence a 
response parameter R sfLF is defined as a 
normalized maximum load factor w'ith a 


maximum value of unity indicating that the design 
has been reached for the specified combination of 
variables. 

The toughness-based factor is taken as the ratio of 
the computed strain-energy release rate to the 
critical value. A response parameter Rrt is defined 
as a normalized strain energy release rate ( G 
/G l >\) with a value greater than unity indicating 
unstable damage growth will occur for the 
specified combination of variables. 

The shape-based factor determines if the 
aerodynamic characteristics of the vehicle have 
been significantly altered due to extensive 
deformations of the aeroshell even though 
catastrophic structural damage is not predicted. 
Calculations use selected points on the EEV 
model to evaluate average diameter change or 
change in average angle of the conical shell, or 
use an L : norm of the displacement vector to 
estimate shape change. A response parameter R SF 
is defined as the ratio of some undeformed 
geometry measure (diameter or cone angle) to the 
measure computed from the nonlinear simulation. 

Hence structural analysis requirements are 
defined in part from the event sequence diagrams 
of Figure 5 and the definition of the design 
variables that influence the staictural response. In 
this application, three response metrics are 
proposed to define structural integrity. Detailed, 
finite element analyses are to be performed using 
deterministic methods and thereby provide the 
basis for defining associated response surface 
approximation for each metric. The 
computational approach to provide this input to 
the PRA is described next. 

Computational Approach 

The finite element models used for this 
investigation are described next. The 
computational approach begins with the analysis 
of the eight launch load cases using Model I (a 
complete vehicle finite element model with 
nominal material data, p=l, and without any 
damage, defects, flaws or imperfections; i.e., a 
model of the pristine structure). The simulations 
are PFA simulations and the load factors are 
gradually increased from zero to a maximum 
value of unity for each load case. A maximum 
value of unity implies that the structure carried 
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the full magnitude of the load case considered - 
local damage may be present but did not prevent 
the structure from converging at the full load. A 
maximum value less than unity implies that the 
design loads could not be sustained by the- 
structure. Results include the failure indices from 
the chosen failure criteria (failure modes are 
grouped as fiber or matrix failure indices, e t and 
<?„„ respectively). The fiber failure indices for 
tension and compression are examined and the 
highest value of e u and e k is then assigned to c t 
(similarly for the matrix failure indices). In 
addition, the transverse shear strain energy and 
total strain energy by element are archived. 
Following each analysis, the failure index 
distributions by layer are reviewed and a 
cumulative distribution for each failure index (/>., 
number of elements with a failure index greater 
than P) is computed. These distributions are used 
to identify “initiated" imperfection sites. These 
“initiated" imperfections are used to simulate 
possible manufacturing defects or voids with a 
size defined by the NDE inspection limit (or at 
least a single element) where the specific failure 
index causes a corresponding material 
degradation in those locations. The union of all 
such “initiated" imperfection sites are then 
incorporated into Model 1 and called Model 1 A. 

The eight launch load cases are then re-analyzed 
using Model 1A. The results of these PFA 
simulations are evaluated to see if additional 
strength-related failures (via the Hashin criteria) 
have occurred. If no additional strength-related 
failures are detected beyond those incorporated by 
changing p, then Model 1A defines the baseline 
finite element model for the re-entry load case; 
that is. Model 2. If additional strength-related 
failures are detected, then the union of all 
strength-related failures superposed on those 
already in Model 1A becomes the baseline finite 
element model for re-entry. Model 2. Hence the 
baseline finite element model to study the re-entry 
load case assumes that any manufacturing or 
fabrication flaw's, defects, or delaminations have 
been detected by NDH inspection. Any initial 
undetected defect is simulated by material 
degradation. Furthermore it is assumed that if the 
PFA simulations for any launch load case leads to 
a predicted failure, then design changes w r ould be 
made before proceeding to analyze the re-entry 
load case. At this point, sixteen PFA simulations 
have been performed. 


Next, a PFA simulation is performed using the 
baseline finite element model. Model 2, for the re- 
entry load case. Candidate locations for the 
“initial" delaminations are determined by 
examining the transverse shear strain energy 
distribution wTthin the model, while candidate 
locations for “initial" disbonds are determined 
based on assembly and manufacturing 
information or heritage data. For these identified 
locations, the baseline finite element model is 
modified to include locally refined regions for 
strain-energy-release-rate calculations using a 
technique such as the virtual crack closure 
technique (VCCT). Each location may have its 
own initial size, location and orientation. 
Simulation results will need to insure that these 
effects do not interact; and if they do, then further 
modifications to the finite element will be 
required. Incorporating these “initial" flaws 
w'ithin Model 2 leads to Model 3A, w'hich reflects 
these initial flaw's plus any strength-related 
failures predicted from the launch load cases. 

PFA simulations are performed for different flaw' 
sizes (Models 3A. 3B and 30 to develop a strain- 
energy release rate versus flaw size family of 
curves. These results are used to define a nominal 
value of the flaw size random variable. Model 3 A 
is then modified to reflect the off-nominal flaw 
sizes and called Model 4. This model has 
nominal material properties for much of the 
model, nominal geometry, regions with material 
degradation due to strength-related failures from 
the launch load cases, and embedded flaws 
simulating delaminations and disbonds. 

At this point, twenty PFA simulations have been 
performed and the baseline finite element model 
(Model 3 A) for re-entry has been defined. This 
model is then used with the re-entry load case and 
the various combinations of the design variable 
groups to determine the three defined response 
parameters for each set. Results obtained using 
Model 3A represents the case of nominal values 
for each design variable group - including flaw' 
sizes. The off-nominal value for the flaw size and 
damage from launch require modifications to 
Model 3 A that lead to Model 4. Off-nominal 
values of the toughness group require only 
additional post-processing of the PFA simulation 
results. Therefore for the four groups of design 
variables identified, another sixteen (2 4 ) PFA 
simulations are required, giving a total of thirty* 
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six simulations. Clearly risk-based design 
incorporating damage tolerance requires 
significant computational effort. Even with the 
use of response surface approximations, the 
necessary computations may tax a computation 
infrastructure. Advanced computing strategies [4- 
7] need to be harnessed as an enabling 
infrastructure. 

To summarize the computational effort to 
incorporate damage tolerant analyses in a 
probabilistic risk assessment of a candidate EEV 
structure includes thirty-six PFA simulations plus 
selected post-processing calculations. These 
simulation results are used to generate the 
response surfaces corresponding to the three 
identified response metrics and four groups of 
random variables for a two-level full factorial 
design approach. Additional PFA simulations 
may be required to investigate some aspect further 
or to improve the fidelity of the results. 
Employing the decohesion element modeling 
approach for delamination and disbond modeling 
would require sixteen additional simulations since 
the toughness design variable group would be 
explicitly included as part of the simulations. 

Probabilistic Analyses 

The results of these deterministic analyses 
provide the basis for generating the response 
surface approximations. A response surface is 
formed for each structural response metric 
defined to assess structural performance in 
meeting mission objectives. The response 
surfaces are then incorporated into the 
probabilistic analysis strategy as an approximate 
method of assessing damage-tolerant structural 
performance without requiring a full PFA 
simulation. Each design variable group has an 
associated statistical distribution function either 
known from heritage data, test results, and/or 
expert opinion. For a specific value of a design 
variable, the probability of that variable taking on 
at least that value is known. Collectively the set 
of design variables is used to determine the 
corresponding response. Then using their 
probabilities, the probability of the response 
reaching at least a certain value can be 
determined. 


Concluding Remarks 

An approach for incorporating damage tolerance 
analysis with risk-based structural design has 
been discussed within the context of a candidate 
EEV composite aeroshell structure. The approach 
described a process of accounting for local 
material flaws and strength-related material 
failures within a probabilistic risk assessment. 
Progressive failure and fracture mechanics-based 
analyses are to be performed. Because of the 
computational effort required to assess the 
structural integrity of the EEV composite 
aeroshell structure, design optimization 
techniques based on response surface 
approximations are incorporated. in addition, 
related design variables affecting damage 
tolerance are grouped together with the same 
probability distributions. 

Nonlinear structural analyses of the EEV structure 
are to be performed to account for launch and re- 
entry loads in both a pristine state and an 
“imperfect” state to establish the damage 
tolerance of the structure. The design variable 
groups for the re-entry cases include five groups 
that account for variability in elastic moduli, 
strength, interlaminar fracture toughness, damage 
from launch, and delamination/disbond size. 
Three response metrics are considered including 
strength, toughness and vehicle shape to 
determine the contribution of the supporting 
structure to meet mission goals. Using a two-level 
full factorial design approach, the number of 
deterministic analyses required to determine the 
coefficients that define the response surfaces for 
each response metric. These response surfaces are 
subsequently used innumerable times in the 
probabilistic analyses as substitutes for detailed 
deterministic analyses. The design variable 
groups are treated as random variables in these 
probabilistic analyses. The approach presented in 
this paper outlines a framework and the steps 
needed to support a probabilistic risk assessment 
of damage-tolerant composite structural 
components of a spacecraft system. However, it 
should be clearly understood that the simulations 
and damage models included have implicit 
assumptions regarding how material failures will 
initiate and propagate. Accounting for failure 
mechanisms and damage modes not included in 
the mathematical models needs to be part of the 
overall risk assessment. 
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Figure 1 . Components of a Holistic Progressive Failure Methodology for Composite Structures. 
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a = mixed mode ratio 


Figure 2. Fracture Mechanics Testing for Disbonds and Delaminations. 
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Figure 4. Candidate Earth-Entry Vehicle System. 
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Figure 5. Representative Event Sequence Diagram for Re-entry. 
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